fs fd90065048 fix(security): add CSRF protection to all POST endpoints + contract tests (B2) ...

CSRF guards added to 16 admin pages that previously accepted POST requests
without token verification (GR-SEC-001): departments, permissions, roles,
settings, tenants, users (create/edit/bulk/tokens), and lang switch.

New contract tests:
- PostEndpointCsrfContractTest: scans all pages/ for POST handlers and
  verifies checkCsrfToken is present (API/data endpoints exempt).
- DatabaseUpdatesContractTest: validates db/updates/ scripts follow naming
  convention and use idempotent SQL patterns (GR-CORE-010).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-03-10 15:40:07 +01:00

..

_form.phtml

major update

2026-03-04 15:56:58 +01:00

access-pdf-bulk().php

fix(security): add CSRF protection to all POST endpoints + contract tests (B2)

2026-03-10 15:40:07 +01:00

access-pdf($id).php

refactor(pages): replace superglobals with request/session abstractions

2026-03-06 11:28:22 +01:00

activate($id).php

refactor(pages): replace superglobals with request/session abstractions

2026-03-06 11:28:22 +01:00

api-token-create($id).php

fix(security): add CSRF protection to all POST endpoints + contract tests (B2)

2026-03-10 15:40:07 +01:00

api-token-revoke($id).php

fix(security): add CSRF protection to all POST endpoints + contract tests (B2)

2026-03-10 15:40:07 +01:00

avatar-delete($id).php

refactor(pages): replace superglobals with request/session abstractions

2026-03-06 11:28:22 +01:00

avatar-file().php

refactor(pages): replace superglobals with request/session abstractions

2026-03-06 11:28:22 +01:00

avatar-file(none).phtml

baseline

2026-02-04 23:31:53 +01:00

avatar($id).php

refactor(pages): replace superglobals with request/session abstractions

2026-03-06 11:28:22 +01:00

bulk($action).php

fix(security): add CSRF protection to all POST endpoints + contract tests (B2)

2026-03-10 15:40:07 +01:00

create().php

fix(security): add CSRF protection to all POST endpoints + contract tests (B2)

2026-03-10 15:40:07 +01:00

create(default).phtml

major update

2026-03-04 15:56:58 +01:00

data().php

refactor(pages): replace superglobals with request/session abstractions

2026-03-06 11:28:22 +01:00

deactivate($id).php

refactor(pages): replace superglobals with request/session abstractions

2026-03-06 11:28:22 +01:00

delete($id).php

refactor(pages): replace superglobals with request/session abstractions

2026-03-06 11:28:22 +01:00

edit($id).php

fix(security): add CSRF protection to all POST endpoints + contract tests (B2)

2026-03-10 15:40:07 +01:00

edit(default).phtml

major update

2026-03-04 15:56:58 +01:00

export().php

refactor(pages): replace superglobals with request/session abstractions

2026-03-06 11:28:22 +01:00

export(none).phtml

baseline

2026-02-04 23:31:53 +01:00

filter-schema.php

major update

2026-03-04 15:56:58 +01:00

forget-tokens($id).php

refactor(pages): replace superglobals with request/session abstractions

2026-03-06 11:28:22 +01:00

index().php

refactor(pages): replace superglobals with request/session abstractions

2026-03-06 11:28:22 +01:00

index($slug).php

listen ansichten verbessert

2026-03-05 11:17:42 +01:00

index(default).phtml

Repo Interface für tests

2026-03-05 08:26:51 +01:00

send-access($id).php

refactor(pages): replace superglobals with request/session abstractions

2026-03-06 11:28:22 +01:00

switch-tenant().php

fix(theme): stabilize tenant switch theme propagation and toggle race handling

2026-03-07 20:14:29 +01:00

theme().php

refactor(pages): replace superglobals with request/session abstractions

2026-03-06 11:28:22 +01:00